Помогите разобраться. Есть mikrotik hap ac RouterOS 6.47.8
Есть внешний статичный IP адрес, который выдается провайдером, допустим 1.1.1.1
Локальный адрес роутера 192.168.88.1
Настроил по мануалам SMB, и тут самое странное для меня. Войти в шару из локальной сети (wifi, кабель) могу только по внешнему IP 1.1.1.1 По внутреннему не пускает
. Сам роутер пингуется (192.168.88.1). Доступ к роутеру извне закрыт.Что я сделал не так?
Код: Выделить всё
/interface bridge
add arp=reply-only igmp-snooping=yes mtu=1500 name=Guest-bridge protocol-mode=none
add arp=proxy-arp igmp-snooping=yes mtu=1500 name=LAN-bridge protocol-mode=none
/interface ethernet
set [ find default-name=ether2 ] name=LAN1
set [ find default-name=ether3 ] name=LAN2
set [ find default-name=ether4 ] name=LAN3
set [ find default-name=ether5 ] name=LAN4
set [ find default-name=ether1 ] name=WAN
set [ find default-name=sfp1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes disabled=no interface=WAN name=internet_provider user=******
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode antenna-gain=0 band=2ghz-onlyn basic-rates-b="" channel-width=20/40mhz-XX country=\
no_country_set disabled=no disconnect-timeout=15s distance=indoors frequency=auto frequency-mode=manual-txpower hide-ssid=yes hw-protection-mode=rts-cts \
hw-retries=10 installation=indoor mode=ap-bridge name=wlan1-wifi24ghz on-fail-retry-time=1s radio-name=wifisid_1 rate-set=configured ssid=wifisid station-roaming=\
enabled supported-rates-b="" tx-power-mode=all-rates-fixed wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
set [ find default-name=wlan2 ] adaptive-noise-immunity=ap-and-client-mode antenna-gain=0 band=5ghz-n/ac channel-width=20/40/80mhz-XXXX country=no_country_set \
disabled=no disconnect-timeout=15s distance=indoors frequency=auto frequency-mode=manual-txpower hide-ssid=yes hw-protection-mode=rts-cts hw-retries=10 \
installation=indoor mode=ap-bridge name=wlan2-wifi5ghz on-fail-retry-time=1s radio-name=wifisidf_2 ssid=wifisidf station-roaming=enabled tx-power-mode=all-rates-fixed \
wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
/interface list
add comment="Local list" name=Local
add comment="Internet/Wan list" name=Internet
add comment="Wifi List" name=WiFi
/interface wireless
add default-forwarding=no disabled=no keepalive-frames=disabled mac-address=****** master-interface=wlan1-wifi24ghz multicast-buffering=disabled name=\
wlan3-wifi24ghz-guest security-profile=Guest ssid=wifisidg station-roaming=enabled wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/ip pool
add name=LAN-DHCP-Pool ranges=192.168.88.30-192.168.88.60
add name=Guest-DHCP-Pool ranges=172.16.1.10-172.16.1.30
/ip dhcp-server
add add-arp=yes address-pool=LAN-DHCP-Pool bootp-lease-time=lease-time bootp-support=dynamic disabled=no interface=LAN-bridge lease-time=12h name=DHCP-Server
add add-arp=yes address-pool=Guest-DHCP-Pool bootp-lease-time=lease-time bootp-support=dynamic disabled=no interface=Guest-bridge lease-time=12h name=\
Guest-DHCP-Server
/queue simple
add burst-limit=80M/80M burst-threshold=70M/70M burst-time=10s/10s disabled=yes max-limit=60M/60M name=guest-wifi target=Guest-bridge
/queue interface
set wlan1-wifi24ghz queue=only-hardware-queue
set wlan2-wifi5ghz queue=only-hardware-queue
/interface wireless nstreme
set wlan1-wifi24ghz enable-polling=no
set wlan2-wifi5ghz enable-polling=no
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,tikapp
/interface bridge port
add bridge=LAN-bridge interface=LAN1
add bridge=LAN-bridge interface=LAN2
add bridge=LAN-bridge interface=LAN3
add bridge=LAN-bridge interface=LAN4
add bridge=LAN-bridge interface=wlan1-wifi24ghz
add bridge=LAN-bridge interface=wlan2-wifi5ghz
add bridge=Guest-bridge interface=wlan3-wifi24ghz-guest
/ip neighbor discovery-settings
set discover-interface-list=none
/interface list member
add interface=LAN1 list=Local
add interface=LAN2 list=Local
add interface=LAN3 list=Local
add interface=LAN4 list=Local
add interface=WAN list=Internet
add interface=wlan1-wifi24ghz list=WiFi
add interface=wlan2-wifi5ghz list=WiFi
add interface=internet_provider list=Internet
add interface=wlan1-wifi24ghz list=Local
add interface=wlan2-wifi5ghz list=Local
add interface=LAN-bridge list=Local
add list=Local
/ip address
add address=192.168.88.1/24 interface=LAN-bridge network=192.168.88.0
add address=172.16.1.1/24 interface=Guest-bridge network=172.16.1.0
/ip dhcp-client
add disabled=no interface=WAN use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=172.16.1.0/24 dns-server=172.16.1.1,172.16.1.2 gateway=172.16.1.1 netmask=24
add address=192.168.88.0/24 dns-server=192.168.88.1,192.168.88.2 gateway=192.168.88.1 netmask=24 wins-server=192.168.88.1
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=no_forward_ipv4
add address=169.254.0.0/16 comment=RFC6890 list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
add address=127.0.0.0/8 comment=RFC6890 list=bad_ipv4
add address=192.0.0.0/24 comment=RFC6890 list=bad_ipv4
add address=192.0.2.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=198.51.100.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=203.0.113.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=240.0.0.0/4 comment="RFC6890 reserved" list=bad_ipv4
add address=0.0.0.0/8 comment=RFC6890 list=local_ipv4
add address=10.0.0.0/8 comment=RFC6890 disabled=yes list=local_ipv4
add address=100.64.0.0/10 comment=RFC6890 list=local_ipv4
add address=169.254.0.0/16 comment=RFC6890 list=local_ipv4
add address=172.16.0.0/12 comment=RFC6890 list=local_ipv4
add address=192.0.0.0/29 comment=RFC6890 list=local_ipv4
add address=192.168.0.0/16 comment=RFC6890 disabled=yes list=local_ipv4
add address=198.18.0.0/15 comment="RFC6890 benchmark" list=local_ipv4
add address=255.255.255.255 comment="RFC6890 benchmark" list=local_ipv4
add address=192.168.0.0/16 comment=RFC6890 disabled=yes list=bad_src_ipv4
add address=255.255.255.255 comment=RFC6890 list=bad_src_ipv4
add address=0.0.0.0/8 comment=RFC6890 list=bad_dst_ipv4
add address=224.0.0.0/4 comment=RFC6890 list=bad_dst_ipv4
/ip firewall filter
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related
add action=accept chain=forward comment="Accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop all from Internet not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=Internet
add action=drop chain=forward comment="Drop bad forward IPs" dst-address-list=no_forward_ipv4
add action=drop chain=forward comment="Drop bad forward IPs" src-address-list=no_forward_ipv4
add action=add-src-to-address-list address-list=ddos-blacklist address-list-timeout=1d chain=input comment="DDoS Protect - Connection Limit" connection-limit=100,32 \
in-interface-list=Internet protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=jump chain=forward comment="DDoS Protect - SYN Flood" connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface-list=!Local jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect connection-state=new limit=200,5:packet log-prefix=SYN-PROTECT protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp tcp-flags=syn
add action=accept chain=input dst-port=53 in-interface=Guest-bridge protocol=udp src-port=""
add action=accept chain=input dst-port=53 in-interface=LAN-bridge protocol=udp
add action=accept chain=input comment="Accept ICMP after RAW" protocol=icmp
add action=accept chain=input comment="Accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="Drop all not coming from LAN" in-interface-list=!Local log-prefix=DROP_INPUT_NOT_LOCAL
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=Internet src-address=192.168.88.0/24
add action=masquerade chain=srcnat out-interface-list=Internet src-address=172.16.1.0/24
add action=redirect chain=dstnat dst-port=53 in-interface-list=Local protocol=udp
add action=redirect chain=dstnat dst-port=53 in-interface-list=Local protocol=tcp
add action=redirect chain=dstnat dst-port=53 in-interface=Guest-bridge protocol=udp
/ip firewall raw
add action=accept chain=prerouting comment="Accept DHCP discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=Local protocol=udp src-address=0.0.0.0 \
src-port=68
add action=drop chain=prerouting comment="Drop bogon IP's" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="Drop bogon IP's" dst-address-list=bad_ipv4 log-prefix=BAD_IPV4
add action=drop chain=prerouting comment="Drop bogon IP's" log-prefix=BAD_SRC_IPV4 src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="Drop bogon IP's" dst-address-list=bad_dst_ipv4 log-prefix=BAD_DST_IPV4
add action=drop chain=prerouting comment="Drop local IP from Internet" in-interface-list=Internet src-address-list=local_ipv4
add action=drop chain=prerouting comment="Drop forward to local lan from Internet" dst-address=192.168.88.0/24 in-interface-list=Internet
add action=drop chain=prerouting dst-address=172.16.1.0/24 in-interface-list=Internet
add action=drop chain=prerouting comment="Drop local if not from default IP range" in-interface-list=Local src-address=!192.168.88.0/24
add action=drop chain=prerouting in-interface=Guest-bridge src-address=!172.16.1.0/24
add action=drop chain=prerouting comment="Drop bad UDP" port=0 protocol=udp
add action=jump chain=prerouting comment="Jump to ICMP chain" jump-target=icmp4 protocol=icmp
add action=jump chain=prerouting comment="Jump to TCP chain" jump-target=bad_tcp protocol=tcp
add action=accept chain=prerouting comment="Accept everything else from Guest" in-interface=Guest-bridge
add action=accept chain=prerouting comment="Accept everything else from Local" in-interface-list=Local
add action=accept chain=prerouting comment="Accept everything else from Internet" in-interface-list=Internet
add action=drop chain=prerouting comment="Drop the rest" log=yes log-prefix=DROP_RAW
add action=drop chain=bad_tcp comment="TCP flag filter" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,syn
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,rst
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,!ack
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,urg
add action=drop chain=bad_tcp protocol=tcp tcp-flags=syn,rst
add action=drop chain=bad_tcp protocol=tcp tcp-flags=rst,urg
add action=drop chain=bad_tcp comment="TCP port 0 drop" port=0 protocol=tcp
add action=accept chain=icmp4 comment="ICMP. echo reply" icmp-options=0:0 limit=5,10:packet protocol=icmp
add action=accept chain=icmp4 comment="ICMP net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp4 comment="ICMP host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp4 comment="ICMP protocol unreachable" icmp-options=3:2 protocol=icmp
add action=accept chain=icmp4 comment="ICMP port unreachable" icmp-options=3:3 protocol=icmp
add action=accept chain=icmp4 comment="ICMP fragmentation needed" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp4 comment="ICMP echo" icmp-options=8:0 limit=5,10:packet protocol=icmp
add action=drop chain=icmp4 comment="ICMP drop other icmp" protocol=icmp
add action=accept chain=icmp4 comment="ICMP time exceeded " icmp-options=11:0-255 protocol=icmp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set sip disabled=yes
/ip route rule
add action=unreachable dst-address=172.16.1.0/24 src-address=192.168.88.0/24
add action=unreachable dst-address=192.168.88.0/24 src-address=172.16.1.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.88.0/24
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.88.0/24
set api-ssl disabled=yes
/ip smb
set allow-guests=no domain=WORKGROUP enabled=yes
/ip smb shares
set [ find default=yes ] disabled=yes
add directory=/disk1 name=data
/ip smb users
add name=john read-only=no
/ip upnp interfaces
add interface=LAN-bridge type=internal
add interface=internet_provider type=external
add disabled=yes interface=Guest-bridge type=internal
add interface=WAN type=external
/system leds
set 2 disabled=yes
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=Local
/tool mac-server mac-winbox
set allowed-interface-list=Local
/tool mac-server ping
set enabled=no